The Convergence of eBPF, Buildroot, and QEMU for Automated Linux Malware Analysis

This course covers the learning outcomes and goals of conducting in-depth analysis of Linux-based malware such as Mirai and AvosLocker. It teaches the principles of extended Berkeley Packet Filter (eBPF) for tracing and observability, utilizing Buildroot to develop Linux sandboxes, and employing QEMU for emulation. The teaching method includes a talk with a speaker introduction, agenda overview, eBPF principles explanation, ELFEN sandbox demonstration, and future work discussion. The intended audience for this course includes cybersecurity professionals, malware analysts, and individuals interested in Linux malware analysis.